發現局域網肉機或者p2p連接

2019-11-05 03:08:57

字體：大中小

來源：轉載

供稿：網友

被黑客控制,作為攻擊機器的肉機,以及員工們自己裝的p2p軟件,像eMule,BT,有個共同的特點就是消耗大量的帶寬,影響公司正常的網絡訪問,假如公司的計算機多到網絡一定的數量,要定位這種帶寬使用大戶,一般的手段,比較麻煩.

安恒公司是這樣做的,
在公司的網關，設置了conn_limit ,讓每臺機器只有15個連接。假如連接數量超過了限制,機器就會被暫時禁止訪問外網.被禁止的人就會知道是自己的機器出現狀況,因為,只有自己不能訪問外網,問題出在自己.大部分的情況下,他就會自行解決,不會反映到網絡部.

下面是一個實例:
有同事反映不能上網,在網關進行tcpdump,發現網關給客戶機發回[不可到達]icmp控制信息, 當然限制就發生在網關,
anheng:~# tcpdump -n host 192.168.0.25
tcpdump: verbose output supPRessed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes
15:48:13.258203 ip 192.168.0.25.1112 > 202.101.42.11.139: S 216008989:216008989(0) win 65535 <mss 1460,nop,nop,sackOK>
15:48:13.258270 IP 192.168.0.111 > 192.168.0.25: icmp 56: 202.101.42.11 tcp port 139 unreachable
15:48:16.262864 IP 192.168.0.25.1112 > 202.101.42.11.139: S 216008989:216008989(0) win 65535 <mss 1460,nop,nop,sackOK>
15:48:16.262942 IP 192.168.0.1 > 192.168.1.25: icmp 56: 202.101.42.11 tcp port 139 unreachable

查看已存在的連接:
dianserv:~# cat /proc/net/ip_conntrack grep 192.168.0.25
tcp      6 411419 ESTABLISHED src=192.168.0.25 dst=221.196.118.162 sport=1838 dport=11049 src=221.196.118.162 dst=220.202.10.102 sport=11049 dport=1838 [ASSURED] use=1
tcp      6 414788 ESTABLISHED src=192.168.0.25 dst=218.91.32.244 sport=1951 dport=16881 src=218.91.32.244 dst=220.202.10.102 sport=16881 dport=1951 [ASSURED] use=1
udp      17 175 src=192.168.0.25 dst=210.22.70.3 sport=1037 dport=53 src=210.22.70.3 dst=220.202.10.102 sport=53 dport=1037 [ASSURED] use=1
tcp      6 414764 ESTABLISHED src=192.168.0.25 dst=222.241.78.212 sport=2242 dport=24965 src=222.241.78.212 dst=220.202.10.102 sport=24965 dport=2242 [ASSURED] use=1
tcp      6 412382 ESTABLISHED src=192.168.0.25 dst=61.185.35.133 sport=1955 dport=10901 src=61.185.35.133 dst=220.202.10.102 sport=10901 dport=1955 [ASSURED] use=1
tcp      6 414757 ESTABLISHED src=192.168.0.25 dst=218.88.169.103 sport=1839 dport=15340 src=218.88.169.103 dst=220.202.10.102 sport=15340 dport=1839 [ASSURED] use=1
tcp      6 427233 ESTABLISHED src=192.168.0.25 dst=218.84.176.152 sport=1127 dport=13903 src=218.84.176.152 dst=220.202.10.102 sport=13903 dport=1127 [ASSURED] use=1
tcp      6 414784 ESTABLISHED src=192.168.0.25 dst=80.117.23.51 sport=2279 dport=21283 src=80.117.23.51 dst=220.202.10.102 sport=21283 dport=2279 [ASSURED] use=1
tcp      6 414764 ESTABLISHED src=192.168.0.25 dst=222.36.6.247 sport=1875 dport=16881 src=222.36.6.247 dst=220.202.10.102 sport=16881 dport=1875 [ASSURED] use=1
tcp      6 431993 ESTABLISHED src=192.168.0.25 dst=192.168.1.111 sport=1142 dport=80 src=192.168.1.111 dst=192.168.0.25 sport=80 dport=1142 [ASSURED] use=1
tcp      6 413283 ESTABLISHED src=192.168.0.25 dst=61.185.35.133 sport=2050 dport=10901 src=61.185.35.133 dst=220.202.10.102 sport=10901 dport=2050 [ASSURED] use=1
tcp      6 325787 ESTABLISHED src=192.168.0.25 dst=63.251.135.76 sport=1387 dport=80 src=63.251.135.76 dst=220.202.10.102sport=80 dport=1387 [ASSURED] use=1
tcp      6 414494 ESTABLISHED src=192.168.0.25 dst=61.185.35.133 sport=2318 dport=10901 src=61.185.35.133 dst=220.202.10.102 sport=10901 dport=2318 [ASSURED] use=1
tcp      6 415184 ESTABLISHED src=192.168.0.25 dst=211.83.102.16 sport=2339 dport=1884 src=211.83.102.16 dst=220.202.10.102 sport=1884 dport=2339 [ASSURED] use=1
tcp      6 414790 ESTABLISHED src=192.168.0.25 dst=218.84.176.152 sport=1876 dport=13903 src=218.84.176.152 dst=220.202.10.102 sport=13903 dport=1876 [ASSURED] use=1
tcp      6 413079 ESTABLISHED src=192.168.0.25 dst=61.185.35.133 sport=2020 dport=10901 src=61.185.35.133 dst=220.202.10.102 sport=10901 dport=2020 [ASSURED] use=1